@opengeni/db 1.3.0 → 1.4.2

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-6UKNJ43T.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-NZ2SP55O.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/capability-reconciliation.js

@@ -1,7 +1,7 @@
 import {
   withWorkspaceRls
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/{chunk-7QWWTVYH.js → chunk-5ROHLEN6.js}

@@ -646,6 +646,8 @@ var PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
   "close_private_session_create_capability(uuid)"
 ];
 var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
+  "lock_live_native_original_origin_v2(jsonb)",
+  "modal_native_origin_member_read_active(uuid, text)",
   LEGACY_FORK_SESSION_CONTENT_ROUTINE,
   FORK_SESSION_CONTENT_ROUTINE,
   MESSAGE_FORK_SESSION_CONTENT_ROUTINE,
@@ -744,6 +746,8 @@ var UNIFIED_KNOWLEDGE_AUTHORITY_TABLES = [
   "documents"
 ];
 var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
+  "lock_live_native_original_origin_v2(jsonb)",
+  "modal_native_origin_member_read_active(uuid, text)",
   ...CLAUDE_SUBSCRIPTION_CAPABILITY_ROUTINES,
   "maintain_usage_allowances(integer, integer)",
   "usage_allowance_command(jsonb)",
@@ -1931,15 +1935,15 @@ async function inspectRuntimeDatabasePosture(db, options) {
             -- Column-only grants on capability tables are also unsafe; a pin
             -- table must remain EXECUTE-only even after column ACL drift.
             (has_table_privilege(current_user, c.oid, 'SELECT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'SELECT'))) as can_select,
             (has_table_privilege(current_user, c.oid, 'INSERT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'INSERT'))) as can_insert,
             (has_table_privilege(current_user, c.oid, 'UPDATE') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'UPDATE'))) as can_update,
             has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
@@ -1986,6 +1990,7 @@ async function inspectRuntimeDatabasePosture(db, options) {
               'session_file_read_capabilities',
               'session_import_batches',
               'modal_inventory_read_capabilities',
+              'modal_native_origin_read_capabilities',
               ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE},
               ${VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE},
               'credit_promotion_policy_revisions',
@@ -3714,6 +3719,14 @@ function evaluateRuntimeDatabasePosture(posture, options) {
   if (allowanceAttribution && (allowanceAttribution.owner !== posture.privateTables.find((table) => table.name === "workspace_usage_allowances")?.owner || !allowanceAttribution.rlsEnabled || !allowanceAttribution.rlsForced || !allowanceAttribution.rlsActive)) {
     violations.push("usage allowance attribution receipts lack same-owner FORCE-RLS isolation");
   }
+  const nativeOriginCapability = posture.privateTables.find(
+    (table) => table.name === "modal_native_origin_read_capabilities"
+  );
+  const nativeOriginRoutineInstalled = posture.targetRoutines.some(
+    (routine) => routine.name === "lock_live_native_original_origin_v2(jsonb)"
+  );
+  if ((nativeOriginRoutineInstalled || nativeOriginCapability) && (!nativeOriginCapability || nativeOriginCapability.owner === expectedRole || nativeOriginCapability.owner !== tableByName.get("sessions")?.owner || nativeOriginCapability.owner !== tableByName.get("organization_memberships")?.owner || !nativeOriginCapability.rlsEnabled || !nativeOriginCapability.rlsForced || !nativeOriginCapability.rlsActive || nativeOriginCapability.select || nativeOriginCapability.insert || nativeOriginCapability.update || nativeOriginCapability.delete || nativeOriginCapability.truncate || nativeOriginCapability.references || nativeOriginCapability.trigger))
+    violations.push("Native LIVE-origin read capability has unsafe owner, RLS or privileges");
   const modalInventoryCapability = posture.privateTables.find(
     (table) => table.name === "modal_inventory_read_capabilities"
   );
@@ -4284,6 +4297,8 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "prepare_organization_membership_protocol_settlements(jsonb)",
     "assert_active_managed_human_organization_membership(uuid,text)",
     "resolve_workspace_writer_grant_identity(uuid,text)",
+    "lock_live_native_original_origin_v2(jsonb)",
+    "modal_native_origin_member_read_active(uuid,text)",
     "prepare_workspace_membership_removal_settlements(jsonb)",
     "workspace_membership_removal_command(jsonb)",
     "get_organization_retention_policy(uuid,text)",
@@ -5805,6 +5820,16 @@ BEGIN
         REVOKE ALL ON FUNCTION opengeni_private.list_pending_modal_provider_creates() FROM PUBLIC;
       END IF;
     END IF;
+    IF to_regclass('opengeni_private.modal_native_origin_read_capabilities') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM %I',
+        (SELECT string_agg(quote_ident(attname), ',') FROM pg_attribute
+          WHERE attrelid='opengeni_private.modal_native_origin_read_capabilities'::regclass AND attnum>0 AND NOT attisdropped), ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM PUBLIC;
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM PUBLIC',
+        (SELECT string_agg(quote_ident(attname), ',') FROM pg_attribute
+          WHERE attrelid='opengeni_private.modal_native_origin_read_capabilities'::regclass AND attnum>0 AND NOT attisdropped));
+    END IF;
     IF to_regclass('opengeni_private.sandbox_recovery_rollout') IS NOT NULL THEN
       -- Migration may precede this role's creation. Converge only read access;
       -- runtime identities and PUBLIC never receive recovery activation writes.
@@ -6172,4 +6197,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-7QWWTVYH.js.map
+//# sourceMappingURL=chunk-5ROHLEN6.js.map